1. Field
Embodiments of the present invention generally relate to data communications, and in particular, packet metering and rate limiting in a network processor environment, computer security, and in particular to computer network security.
2. Description of the Related Art
In a multi-client network, many subscribers and groups of subscribers are required to share a limited bandwidth of communication channels. Switches within the multi-client network must balance these shared bandwidth resources among multiple subscribers in a fair manner. Conventional routers attempt to solve this problem by performing packet metering/rate limiting on each physical interface of a routing or forwarding instance. Packet metering is conventionally used to limit the rate at which packets are placed on a network for transmission.
In the case of a multi-client network, for example, it may be desirable to meter and/or identify customers, or certain groups of customers, that are oversubscribing (e.g., using more than their allocated bandwidth). This may not be possible with conventional packet metering because metering is performed at a single physical interface. Another limitation of these conventional metering approaches is that they are not able to support packets that are associated with a variety of virtual interfaces, which may be employed by a virtual router.
Thus, there is a general need for an improved system and method for performing metering in a virtual router based network switch. There is also a general need for a system and method for performing metering in a multi-client network that distinguishes between clients and groups of clients. There is also a need for a system and method that supports a fair sharing of communication resources.